Notes on vendor risk, written for practitioners.

NIS2 asks about your suppliers. Your customers are asking about you.

Article 21 puts supply chain security on every essential and important entity, and they pass it down to you.

DORA vendor evidence in practice: mapping a SOC 2, DPA and continuity plan in one review

A worked DORA vendor review: how to read a SOC 2 report, DPA and BCP against Articles 28 to 30, using four real findings from the ProcureCortex demo.

DORA Article 30 checklist: the mandatory contract clauses and the vendor documents that prove them

All 15 DORA Article 30 contract provisions, what to check in the clause, which vendor document proves it, and the gaps reviewers find most often.

DORA third-party risk explained: what changes for your ICT vendors

DORA makes financial entities answer for every ICT vendor they use. What Articles 28 to 30 require, who counts as an ICT provider, and what vendors get asked for.

Vendor Risk Management in 2026: From Periodic Assessments to Continuous Intelligence

Vendor risk management is moving beyond periodic assessments. Learn how continuous vendor intelligence helps teams detect risk changes earlier, prioritize remediation, and make more defensible third-party decisions.

What Is AI Vendor Risk? A Guide to Evaluating Third-Party AI Providers

Learn what AI vendor risk means, the biggest risks enterprise teams should evaluate, and how to assess AI providers across privacy, security, compliance, governance, and model dependency.

The vendor risk assessment guide for enterprise teams

A structured approach to assessing vendor risk with evidence, severity and reviewer decisions that hold up in audit.

Vendor risk assessment checklist

The document set, framework mapping and reviewer steps to run a consistent vendor assessment from intake to remediation.

How to review vendor SOC 2 reports at scale

What to extract from a SOC 2 report, which sections matter for third-party risk and how to keep reviews consistent across a growing portfolio.

SOC 2 vs ISO 27001 for vendor assessment

How the two frameworks differ as vendor evidence, where they overlap and how to map both to one internal requirement set.

GDPR vendor due diligence: what to look for in a DPA

The clauses that matter in a data processing agreement and how to turn them into structured, reviewable evidence.

Third-party risk vs vendor risk: why the distinction matters

Two programs, one evidence base. How to align procurement-led vendor review with security-led third-party risk management.

Continuous vendor monitoring without continuous busywork

How to decide when a past assessment needs another look, using document change, framework change and remediation status.